Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
logs.elf

Overview

General Information

Sample name:logs.elf
Analysis ID:1669913
MD5:b87154c46db7a0cdeb26029d38c1e258
SHA1:a79640f96ef629bbb7e1191f62cac14075a499ec
SHA256:3d37d29d1a926b702e28b6ae2fe06f72581a84b52cea87bbe5e80ae7b355b6f0
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai, Moobot
Score:100
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Detected Mirai
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Mirai
Yara detected Moobot
Connects to many ports of the same IP (likely port scanning)
Contains symbols with names commonly found in malware
Sample deletes itself
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1669913
Start date and time:2025-04-20 19:17:36 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 24s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:logs.elf
Detection:MAL
Classification:mal100.troj.evad.linELF@0/0@1/0
  • VT rate limit hit for: update.byeux.com

Runtime Messages

Command:/tmp/logs.elf
PID:5541
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
done.
Standard Error:

Process Tree

  • system is lnxubuntu20
  • logs.elf (PID: 5541, Parent: 5462, MD5: b87154c46db7a0cdeb26029d38c1e258) Arguments: /tmp/logs.elf
    • logs.elf New Fork (PID: 5542, Parent: 5541)
      • logs.elf New Fork (PID: 5543, Parent: 5542)
      • logs.elf New Fork (PID: 5544, Parent: 5542)
        • logs.elf New Fork (PID: 5545, Parent: 5544)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
NameDescriptionAttributionBlogpost URLsLink
MooBotNo Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
logs.elfJoeSecurity_MoobotYara detected MoobotJoe Security
    logs.elfJoeSecurity_Mirai_3Yara detected MiraiJoe Security
      logs.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        logs.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
        • 0xbad8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbaec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbb00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbb14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbb28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbb3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbb50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbb64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbb78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbb8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbba0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbbb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbbc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbbdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbbf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbc04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbc18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbc2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbc40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbc54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbc68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        logs.elfLinux_Trojan_Mirai_122ff2e6unknownunknown
        • 0x6fb7:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
        Click to see the 2 entries

        Memory Dumps

        SourceRuleDescriptionAuthorStrings
        5541.1.0000000008048000.0000000008056000.r-x.sdmpJoeSecurity_MoobotYara detected MoobotJoe Security
          5541.1.0000000008048000.0000000008056000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
            5541.1.0000000008048000.0000000008056000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
            • 0xbad8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbaec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbb00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbb14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbb28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbb3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbb50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbb64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbb78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbb8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbba0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbbb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbbc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbbdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbbf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbc04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbc18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbc2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbc40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbc54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            • 0xbc68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
            5541.1.0000000008048000.0000000008056000.r-x.sdmpLinux_Trojan_Mirai_122ff2e6unknownunknown
            • 0x6fb7:$a: 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89
            5541.1.0000000008048000.0000000008056000.r-x.sdmpLinux_Trojan_Mirai_fa48b592unknownunknown
            • 0xae95:$a: 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F
            Click to see the 3 entries

            Suricata Signatures

            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2025-04-20T19:18:29.328130+020020304911Malware Command and Control Activity Detected192.168.2.1545212107.189.28.12758431TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2025-04-20T19:18:29.605398+020020304891Malware Command and Control Activity Detected107.189.28.12758431192.168.2.1545212TCP
            2025-04-20T19:18:39.679286+020020304891Malware Command and Control Activity Detected107.189.28.12758431192.168.2.1545212TCP
            2025-04-20T19:18:59.683618+020020304891Malware Command and Control Activity Detected107.189.28.12758431192.168.2.1545212TCP
            2025-04-20T19:19:19.687591+020020304891Malware Command and Control Activity Detected107.189.28.12758431192.168.2.1545212TCP
            2025-04-20T19:19:39.691862+020020304891Malware Command and Control Activity Detected107.189.28.12758431192.168.2.1545212TCP
            2025-04-20T19:19:59.696930+020020304891Malware Command and Control Activity Detected107.189.28.12758431192.168.2.1545212TCP
            2025-04-20T19:20:19.702879+020020304891Malware Command and Control Activity Detected107.189.28.12758431192.168.2.1545212TCP

            Joe Sandbox Signatures

            • • AV Detection
            • • Networking
            • • System Summary
            • • Persistence and Installation Behavior
            • • Hooking and other Techniques for Hiding and Protection
            • • Stealing of Sensitive Information
            • • Remote Access Functionality

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: logs.elfAvira: detected
            Source: logs.elfVirustotal: Detection: 42%Perma Link
            Source: logs.elfReversingLabs: Detection: 52%

            Networking

            barindex
            Source: Network trafficSuricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.15:45212 -> 107.189.28.127:58431
            Source: Network trafficSuricata IDS: 2030489 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response : 107.189.28.127:58431 -> 192.168.2.15:45212
            Source: global trafficTCP traffic: 107.189.28.127 ports 58431,1,3,4,5,8
            Source: global trafficTCP traffic: 192.168.2.15:45212 -> 107.189.28.127:58431
            Source: global trafficDNS traffic detected: DNS query: update.byeux.com

            System Summary

            barindex
            Source: logs.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: logs.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
            Source: logs.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
            Source: logs.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
            Source: 5541.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5541.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_122ff2e6 Author: unknown
            Source: 5541.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa48b592 Author: unknown
            Source: 5541.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
            Source: Process Memory Space: logs.elf PID: 5541, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: ELF static info symbol of initial sampleName: attack.c
            Source: ELF static info symbol of initial sampleName: attack_get_opt_int
            Source: ELF static info symbol of initial sampleName: attack_get_opt_ip
            Source: ELF static info symbol of initial sampleName: attack_gre_ip
            Source: ELF static info symbol of initial sampleName: attack_init
            Source: ELF static info symbol of initial sampleName: attack_kill_all
            Source: ELF static info symbol of initial sampleName: attack_method_nudp
            Source: ELF static info symbol of initial sampleName: attack_method_tcp
            Source: ELF static info symbol of initial sampleName: attack_ongoing
            Source: ELF static info symbol of initial sampleName: attack_parse
            Source: logs.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: logs.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
            Source: logs.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
            Source: logs.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
            Source: 5541.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5541.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_122ff2e6 reference_sample = c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348, id = 122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80, last_modified = 2021-09-16
            Source: 5541.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa48b592 reference_sample = c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88, id = fa48b592-8d80-45af-a3e4-232695b8f5dd, last_modified = 2021-09-16
            Source: 5541.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
            Source: Process Memory Space: logs.elf PID: 5541, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: classification engineClassification label: mal100.troj.evad.linELF@0/0@1/0
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/110/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/231/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/111/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/112/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/233/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/113/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/114/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/235/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/115/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/1333/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/116/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/1695/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/117/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/118/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/5379/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/119/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/911/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/914/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/10/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/917/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/11/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/12/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/13/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/14/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/15/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/16/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/17/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/18/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/19/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/1591/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/120/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/121/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/1/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/122/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/243/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/2/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/123/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/3/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/124/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/1588/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/125/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/4/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/246/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/126/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/5/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/127/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/6/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/1585/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/128/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/7/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/129/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/8/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/800/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/9/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/3884/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/802/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/803/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/804/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/20/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/21/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/3407/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/22/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/23/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/24/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/25/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/26/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/27/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/28/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/29/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/1484/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/490/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/250/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/130/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/251/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/131/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/132/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/133/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/1479/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/378/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/258/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/259/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/931/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/1595/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/812/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/933/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/30/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/3419/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/35/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/3310/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/260/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/261/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/262/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/142/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/263/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/264/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/265/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/145/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/266/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/267/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/268/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/3303/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/269/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/1486/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/1806/cmdlineJump to behavior
            Source: /tmp/logs.elf (PID: 5543)File opened: /proc/3440/cmdlineJump to behavior

            Hooking and other Techniques for Hiding and Protection

            barindex
            Source: /tmp/logs.elf (PID: 5541)File: /tmp/logs.elfJump to behavior

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: logs.elf, type: SAMPLE
            Source: Yara matchFile source: 5541.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: logs.elf PID: 5541, type: MEMORYSTR
            Source: Yara matchFile source: logs.elf, type: SAMPLE
            Source: Yara matchFile source: 5541.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY

            Remote Access Functionality

            barindex
            Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
            Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
            Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
            Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
            Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
            Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
            Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
            Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
            Source: Yara matchFile source: logs.elf, type: SAMPLE
            Source: Yara matchFile source: 5541.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: logs.elf PID: 5541, type: MEMORYSTR
            Source: Yara matchFile source: logs.elf, type: SAMPLE
            Source: Yara matchFile source: 5541.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
            File Deletion            		1
            OS Credential Dumping            		System Service DiscoveryRemote ServicesData from Local System1
            Non-Standard Port            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
            Non-Application Layer Protocol            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
            Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact

            Malware Configuration

            ⊘No configs have been found

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1669913 Sample: logs.elf Startdate: 20/04/2025 Architecture: LINUX Score: 100 20 update.byeux.com 107.189.28.127, 45212, 58431 PONYNETUS United States 2->20 22 Suricata IDS alerts for network traffic 2->22 24 Malicious sample detected (through community Yara rule) 2->24 26 Antivirus / Scanner detection for submitted sample 2->26 28 6 other signatures 2->28 9 logs.elf 2->9         started        signatures3 process4 signatures5 30 Sample deletes itself 9->30 12 logs.elf 9->12         started        process6 process7 14 logs.elf 12->14         started        16 logs.elf 12->16         started        process8 18 logs.elf 14->18         started       

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            logs.elf43%VirustotalBrowse
            logs.elf53%ReversingLabsLinux.Trojan.LnxMirai
            logs.elf100%AviraEXP/ELF.Mirai.Z.A

            Dropped Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            ⊘No Antivirus matches

            Domains and IPs

            Download Network PCAP: filtered – full

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            update.byeux.com
            		107.189.28.127
            		truetrue
              		unknown

              World Map of Contacted IPs

              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs

              Public IPs

              IPDomainCountryFlagASNASN NameMalicious
              107.189.28.127
              		update.byeux.comUnited States
              		53667PONYNETUStrue

              Joe Sandbox View / Context

              IPs

              ⊘No context

              Domains

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              update.byeux.comdebug.dbg.elfGet hashmaliciousMirai, MoobotBrowse
              • 194.59.31.10
              m68k.elfGet hashmaliciousMirai, MoobotBrowse
              • 107.189.4.201
              ppc.elfGet hashmaliciousMirai, MoobotBrowse
              • 107.189.4.201
              spc.elfGet hashmaliciousMirai, MoobotBrowse
              • 107.189.4.201
              sh4.elfGet hashmaliciousMirai, MoobotBrowse
              • 107.189.4.201
              mpsl.elfGet hashmaliciousMirai, MoobotBrowse
              • 107.189.4.201
              x86_64.elfGet hashmaliciousMirai, MoobotBrowse
              • 107.189.4.201
              x86.elfGet hashmaliciousMirai, MoobotBrowse
              • 107.189.4.201
              JVL2bXW1ch.elfGet hashmaliciousMirai, MoobotBrowse
              • 107.189.4.201
              arm7.elfGet hashmaliciousMirai, MoobotBrowse
              • 107.189.4.201

              ASNs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              PONYNETUSSecuriteInfo.com.PUA.Tool.Linux.BtcMine.4802.24105.21242.elfGet hashmaliciousXmrigBrowse
              • 198.251.89.165
              xd.arm7.elfGet hashmaliciousUnknownBrowse
              • 209.141.33.93
              xd.arm5.elfGet hashmaliciousUnknownBrowse
              • 209.141.33.93
              xd.mips.elfGet hashmaliciousUnknownBrowse
              • 209.141.33.93
              xd.mpsl.elfGet hashmaliciousUnknownBrowse
              • 209.141.33.93
              xd.x86.elfGet hashmaliciousUnknownBrowse
              • 209.141.33.93
              xd.arm7.elfGet hashmaliciousMiraiBrowse
              • 209.141.33.93
              xd.x86_64.elfGet hashmaliciousUnknownBrowse
              • 209.141.33.93
              xd.arm5.elfGet hashmaliciousUnknownBrowse
              • 209.141.33.93
              xd.arm.elfGet hashmaliciousUnknownBrowse
              • 209.141.33.93

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              ⊘No created / dropped files found

              Static File Info

              General

              File type:ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
              Entropy (8bit):6.386692245437393
              TrID:
              • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
              • ELF Executable and Linkable format (generic) (4004/1) 49.84%
              File name:logs.elf
              File size:80'974 bytes
              MD5:b87154c46db7a0cdeb26029d38c1e258
              SHA1:a79640f96ef629bbb7e1191f62cac14075a499ec
              SHA256:3d37d29d1a926b702e28b6ae2fe06f72581a84b52cea87bbe5e80ae7b355b6f0
              SHA512:4b899609b13558d190acda2019b1af3884c013cb2db4cd4b9bab96fd3a746a6873543ba1cb6723a84f61097963fdb12640ac3cd0d0f6a4b093cd7da7b2ab90e4
              SSDEEP:1536:hIHLBO8jFXEbTdmd4ZlXO1iKS6CYFyXxhFg:MLBO8jFb4OMUCYFCxU
              TLSH:7E832A85A263C5B7C8870B7801EBEB364932F8D6176D9F06E36DAFF4AE039C47045259
              File Content Preview:.ELF........................4...........4. ...(..............................................c...c.......7..............x...xi..xi..................Q.td............................U..S............h........[]...$.............U......=.k...t..5.....i......i.

              Static ELF Info

              ELF header

              Class:ELF32
              Data:2's complement, little endian
              Version:1 (current)
              Machine:Intel 80386
              Version Number:0x1
              Type:EXEC (Executable file)
              OS/ABI:UNIX - System V
              ABI Version:0
              Entry Point Address:0x8048184
              Flags:0x0
              ELF Header Size:52
              Program Header Offset:52
              Program Header Size:32
              Number of Program Headers:4
              Section Header Offset:59532
              Section Header Size:40
              Number of Section Headers:19
              Header String Table Index:16

              Sections

              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
              NULL0x00x00x00x00x0000
              .initPROGBITS0x80480b40xb40x1c0x00x6AX001
              .textPROGBITS0x80480d00xd00xb5370x00x6AX0016
              .finiPROGBITS0x80536070xb6070x170x00x6AX001
              .rodataPROGBITS0x80536200xb6200x1dac0x00x2A0016
              .eh_framePROGBITS0x80563cc0xd3cc0x5ac0x00x3WA004
              .tbssNOBITS0x80569780xd9780x80x00x403WAT004
              .ctorsPROGBITS0x80569780xd9780x80x00x3WA004
              .dtorsPROGBITS0x80569800xd9800x80x00x3WA004
              .jcrPROGBITS0x80569880xd9880x40x00x3WA004
              .got.pltPROGBITS0x805698c0xd98c0xc0x40x3WA004
              .dataPROGBITS0x80569980xd9980x20c0x00x3WA004
              .bssNOBITS0x8056bc00xdba40x2ff80x00x3WA0032
              .stabPROGBITS0x00xdba40xfc0xc0x01404
              .stabstrSTRTAB0x00xdca00xdb0x00x0001
              .commentPROGBITS0x00xdd7b0xa8c0x00x0001
              .shstrtabSTRTAB0x00xe8070x840x00x0001
              .symtabSYMTAB0x00xeb840x2de00x100x0182814
              .strtabSTRTAB0x00x119640x22ea0x00x0001

              Program Segments

              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
              LOAD0x00x80480000x80480000xd3cc0xd3cc6.58160x5R E0x1000.init .text .fini .rodata
              LOAD0xd3cc0x80563cc0x80563cc0x7d80x37ec4.67470x6RW 0x1000.eh_frame .tbss .ctors .dtors .jcr .got.plt .data .bss
              TLS0xd9780x80569780x80569780x00x80.00000x4R 0x4.tbss
              GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

              Symbols

              NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
              .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              .symtab0x80480b40SECTION<unknown>DEFAULT1
              .symtab0x80480d00SECTION<unknown>DEFAULT2
              .symtab0x80536070SECTION<unknown>DEFAULT3
              .symtab0x80536200SECTION<unknown>DEFAULT4
              .symtab0x80563cc0SECTION<unknown>DEFAULT5
              .symtab0x80569780SECTION<unknown>DEFAULT6
              .symtab0x80569780SECTION<unknown>DEFAULT7
              .symtab0x80569800SECTION<unknown>DEFAULT8
              .symtab0x80569880SECTION<unknown>DEFAULT9
              .symtab0x805698c0SECTION<unknown>DEFAULT10
              .symtab0x80569980SECTION<unknown>DEFAULT11
              .symtab0x8056bc00SECTION<unknown>DEFAULT12
              .symtab0x00SECTION<unknown>DEFAULT13
              .symtab0x00SECTION<unknown>DEFAULT14
              .symtab0x00SECTION<unknown>DEFAULT15
              C.11.5136.symtab0x8053fb424OBJECT<unknown>DEFAULT4
              GET_UID.symtab0x80597241OBJECT<unknown>DEFAULT12
              LOCAL_ADDR.symtab0x80597204OBJECT<unknown>DEFAULT12
              POPBX1.symtab0x805083f0NOTYPE<unknown>DEFAULT2
              POPBX1.symtab0x805089f0NOTYPE<unknown>DEFAULT2
              POPBX1.symtab0x80508ff0NOTYPE<unknown>DEFAULT2
              PUSHBX1.symtab0x805082b0NOTYPE<unknown>DEFAULT2
              PUSHBX1.symtab0x805088b0NOTYPE<unknown>DEFAULT2
              PUSHBX1.symtab0x80508eb0NOTYPE<unknown>DEFAULT2
              RESTBX1.symtab0x80507e90NOTYPE<unknown>DEFAULT2
              SAVEBX1.symtab0x80507dc0NOTYPE<unknown>DEFAULT2
              _Exit.symtab0x804d4d466FUNC<unknown>DEFAULT2
              _GLOBAL_OFFSET_TABLE_.symtab0x805698c0OBJECT<unknown>HIDDEN10
              _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              _L_lock_103.symtab0x805176a16FUNC<unknown>DEFAULT2
              _L_lock_12.symtab0x80528a316FUNC<unknown>DEFAULT2
              _L_lock_140.symtab0x80528e316FUNC<unknown>DEFAULT2
              _L_lock_160.symtab0x805290316FUNC<unknown>DEFAULT2
              _L_lock_17.symtab0x805258e10FUNC<unknown>DEFAULT2
              _L_lock_18.symtab0x805173013FUNC<unknown>DEFAULT2
              _L_lock_191.symtab0x805292313FUNC<unknown>DEFAULT2
              _L_lock_198.symtab0x8051a3816FUNC<unknown>DEFAULT2
              _L_lock_209.symtab0x8051a4816FUNC<unknown>DEFAULT2
              _L_lock_29.symtab0x80528b316FUNC<unknown>DEFAULT2
              _L_lock_32.symtab0x805250110FUNC<unknown>DEFAULT2
              _L_lock_34.symtab0x805332213FUNC<unknown>DEFAULT2
              _L_lock_54.symtab0x805173d16FUNC<unknown>DEFAULT2
              _L_lock_70.symtab0x805065016FUNC<unknown>DEFAULT2
              _L_unlock_101.symtab0x805332f10FUNC<unknown>DEFAULT2
              _L_unlock_102.symtab0x80528d316FUNC<unknown>DEFAULT2
              _L_unlock_113.symtab0x805177a13FUNC<unknown>DEFAULT2
              _L_unlock_152.symtab0x80528f316FUNC<unknown>DEFAULT2
              _L_unlock_167.symtab0x805066013FUNC<unknown>DEFAULT2
              _L_unlock_170.symtab0x805291316FUNC<unknown>DEFAULT2
              _L_unlock_225.symtab0x8051a5813FUNC<unknown>DEFAULT2
              _L_unlock_232.symtab0x805293013FUNC<unknown>DEFAULT2
              _L_unlock_235.symtab0x8051a6513FUNC<unknown>DEFAULT2
              _L_unlock_40.symtab0x805259810FUNC<unknown>DEFAULT2
              _L_unlock_61.symtab0x805250b10FUNC<unknown>DEFAULT2
              _L_unlock_66.symtab0x805174d16FUNC<unknown>DEFAULT2
              _L_unlock_83.symtab0x805175d13FUNC<unknown>DEFAULT2
              _L_unlock_86.symtab0x80528c316FUNC<unknown>DEFAULT2
              _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __CTOR_END__.symtab0x805697c0OBJECT<unknown>DEFAULT7
              __CTOR_LIST__.symtab0x80569780OBJECT<unknown>DEFAULT7
              __C_ctype_b.symtab0x8056ab44OBJECT<unknown>DEFAULT11
              __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __C_ctype_b_data.symtab0x8054ffc768OBJECT<unknown>DEFAULT4
              __DTOR_END__.symtab0x80569840OBJECT<unknown>DEFAULT8
              __DTOR_LIST__.symtab0x80569800OBJECT<unknown>DEFAULT8
              __EH_FRAME_BEGIN__.symtab0x80563cc0OBJECT<unknown>DEFAULT5
              __FRAME_END__.symtab0x80569740OBJECT<unknown>DEFAULT5
              __GI___C_ctype_b.symtab0x8056ab44OBJECT<unknown>HIDDEN11
              __GI___close.symtab0x80507d080FUNC<unknown>HIDDEN2
              __GI___close_nocancel.symtab0x80507da27FUNC<unknown>HIDDEN2
              __GI___ctype_b.symtab0x8056ab84OBJECT<unknown>HIDDEN11
              __GI___errno_location.symtab0x804d9b813FUNC<unknown>HIDDEN2
              __GI___fcntl_nocancel.symtab0x804d3e883FUNC<unknown>HIDDEN2
              __GI___fgetc_unlocked.symtab0x8052940204FUNC<unknown>HIDDEN2
              __GI___glibc_strerror_r.symtab0x804e86826FUNC<unknown>HIDDEN2
              __GI___libc_close.symtab0x80507d080FUNC<unknown>HIDDEN2
              __GI___libc_fcntl.symtab0x804d43b153FUNC<unknown>HIDDEN2
              __GI___libc_open.symtab0x805082091FUNC<unknown>HIDDEN2
              __GI___libc_read.symtab0x80508e091FUNC<unknown>HIDDEN2
              __GI___libc_write.symtab0x805088091FUNC<unknown>HIDDEN2
              __GI___open.symtab0x805082091FUNC<unknown>HIDDEN2
              __GI___open_nocancel.symtab0x805082a33FUNC<unknown>HIDDEN2
              __GI___read.symtab0x80508e091FUNC<unknown>HIDDEN2
              __GI___read_nocancel.symtab0x80508ea33FUNC<unknown>HIDDEN2
              __GI___sigaddset.symtab0x804ed6832FUNC<unknown>HIDDEN2
              __GI___sigdelset.symtab0x804ed8832FUNC<unknown>HIDDEN2
              __GI___sigismember.symtab0x804ed4436FUNC<unknown>HIDDEN2
              __GI___uClibc_fini.symtab0x8050a1356FUNC<unknown>HIDDEN2
              __GI___uClibc_init.symtab0x8050a7739FUNC<unknown>HIDDEN2
              __GI___write.symtab0x805088091FUNC<unknown>HIDDEN2
              __GI___write_nocancel.symtab0x805088a33FUNC<unknown>HIDDEN2
              __GI___xpg_strerror_r.symtab0x804e884191FUNC<unknown>HIDDEN2
              __GI__exit.symtab0x804d4d466FUNC<unknown>HIDDEN2
              __GI_abort.symtab0x804fce4191FUNC<unknown>HIDDEN2
              __GI_accept.symtab0x804e96484FUNC<unknown>HIDDEN2
              __GI_bind.symtab0x804e9b840FUNC<unknown>HIDDEN2
              __GI_brk.symtab0x805304444FUNC<unknown>HIDDEN2
              __GI_chdir.symtab0x804d51839FUNC<unknown>HIDDEN2
              __GI_close.symtab0x80507d080FUNC<unknown>HIDDEN2
              __GI_closedir.symtab0x804d73c130FUNC<unknown>HIDDEN2
              __GI_config_close.symtab0x805147e44FUNC<unknown>HIDDEN2
              __GI_config_open.symtab0x80514aa44FUNC<unknown>HIDDEN2
              __GI_config_read.symtab0x8051214618FUNC<unknown>HIDDEN2
              __GI_connect.symtab0x804e9e084FUNC<unknown>HIDDEN2
              __GI_exit.symtab0x805011493FUNC<unknown>HIDDEN2
              __GI_fclose.symtab0x80515b4380FUNC<unknown>HIDDEN2
              __GI_fcntl.symtab0x804d43b153FUNC<unknown>HIDDEN2
              __GI_fflush_unlocked.symtab0x80526e4447FUNC<unknown>HIDDEN2
              __GI_fgetc.symtab0x8052470145FUNC<unknown>HIDDEN2
              __GI_fgetc_unlocked.symtab0x8052940204FUNC<unknown>HIDDEN2
              __GI_fgets.symtab0x8052518118FUNC<unknown>HIDDEN2
              __GI_fgets_unlocked.symtab0x8052a0c94FUNC<unknown>HIDDEN2
              __GI_fopen.symtab0x805178821FUNC<unknown>HIDDEN2
              __GI_fork.symtab0x8050444524FUNC<unknown>HIDDEN2
              __GI_fputs_unlocked.symtab0x804e73c45FUNC<unknown>HIDDEN2
              __GI_fseek.symtab0x805321424FUNC<unknown>HIDDEN2
              __GI_fseeko64.symtab0x805322c246FUNC<unknown>HIDDEN2
              __GI_fstat.symtab0x8050df470FUNC<unknown>HIDDEN2
              __GI_fwrite_unlocked.symtab0x804e76c111FUNC<unknown>HIDDEN2
              __GI_getc_unlocked.symtab0x8052940204FUNC<unknown>HIDDEN2
              __GI_getdtablesize.symtab0x8050ec032FUNC<unknown>HIDDEN2
              __GI_getegid.symtab0x8050ee08FUNC<unknown>HIDDEN2
              __GI_geteuid.symtab0x8050ee88FUNC<unknown>HIDDEN2
              __GI_getgid.symtab0x8050ef08FUNC<unknown>HIDDEN2
              __GI_getpagesize.symtab0x8050ef819FUNC<unknown>HIDDEN2
              __GI_getpid.symtab0x805067049FUNC<unknown>HIDDEN2
              __GI_getrlimit.symtab0x8050f0c43FUNC<unknown>HIDDEN2
              __GI_getsockname.symtab0x804ea3440FUNC<unknown>HIDDEN2
              __GI_getuid.symtab0x8050f388FUNC<unknown>HIDDEN2
              __GI_inet_addr.symtab0x804e94431FUNC<unknown>HIDDEN2
              __GI_inet_aton.symtab0x8052c98148FUNC<unknown>HIDDEN2
              __GI_initstate_r.symtab0x804ffd7155FUNC<unknown>HIDDEN2
              __GI_ioctl.symtab0x8053070139FUNC<unknown>HIDDEN2
              __GI_isatty.symtab0x8052c1c27FUNC<unknown>HIDDEN2
              __GI_kill.symtab0x804d54843FUNC<unknown>HIDDEN2
              __GI_lseek64.symtab0x805357890FUNC<unknown>HIDDEN2
              __GI_memcpy.symtab0x804e7dc41FUNC<unknown>HIDDEN2
              __GI_memmove.symtab0x8052a6c37FUNC<unknown>HIDDEN2
              __GI_mempcpy.symtab0x805355830FUNC<unknown>HIDDEN2
              __GI_memrchr.symtab0x8052b0c177FUNC<unknown>HIDDEN2
              __GI_memset.symtab0x804e80850FUNC<unknown>HIDDEN2
              __GI_mmap.symtab0x8050d7427FUNC<unknown>HIDDEN2
              __GI_mremap.symtab0x8050f4059FUNC<unknown>HIDDEN2
              __GI_munmap.symtab0x8050f7c43FUNC<unknown>HIDDEN2
              __GI_nanosleep.symtab0x8050fd161FUNC<unknown>HIDDEN2
              __GI_open.symtab0x805082091FUNC<unknown>HIDDEN2
              __GI_opendir.symtab0x804d848132FUNC<unknown>HIDDEN2
              __GI_pipe.symtab0x804d57439FUNC<unknown>HIDDEN2
              __GI_raise.symtab0x80506a4100FUNC<unknown>HIDDEN2
              __GI_random.symtab0x804fdac66FUNC<unknown>HIDDEN2
              __GI_random_r.symtab0x804fed895FUNC<unknown>HIDDEN2
              __GI_read.symtab0x80508e091FUNC<unknown>HIDDEN2
              __GI_readdir.symtab0x804d938127FUNC<unknown>HIDDEN2
              __GI_readdir64.symtab0x8051190129FUNC<unknown>HIDDEN2
              __GI_recv.symtab0x804ea9492FUNC<unknown>HIDDEN2
              __GI_recvfrom.symtab0x804eaf0108FUNC<unknown>HIDDEN2
              __GI_sbrk.symtab0x805101064FUNC<unknown>HIDDEN2
              __GI_select.symtab0x804d611108FUNC<unknown>HIDDEN2
              __GI_send.symtab0x804eb5c92FUNC<unknown>HIDDEN2
              __GI_sendto.symtab0x804ebb8108FUNC<unknown>HIDDEN2
              __GI_setsid.symtab0x804d68031FUNC<unknown>HIDDEN2
              __GI_setsockopt.symtab0x804ec2456FUNC<unknown>HIDDEN2
              __GI_setstate_r.symtab0x8050072161FUNC<unknown>HIDDEN2
              __GI_sigaction.symtab0x8050cff80FUNC<unknown>HIDDEN2
              __GI_sigaddset.symtab0x804ec8434FUNC<unknown>HIDDEN2
              __GI_sigemptyset.symtab0x804eca820FUNC<unknown>HIDDEN2
              __GI_signal.symtab0x804ecbc136FUNC<unknown>HIDDEN2
              __GI_sigprocmask.symtab0x804d6a097FUNC<unknown>HIDDEN2
              __GI_sleep.symtab0x8050708195FUNC<unknown>HIDDEN2
              __GI_socket.symtab0x804ec5c40FUNC<unknown>HIDDEN2
              __GI_sprintf.symtab0x804d9ec30FUNC<unknown>HIDDEN2
              __GI_srandom_r.symtab0x804ff37160FUNC<unknown>HIDDEN2
              __GI_strchr.symtab0x8052a9430FUNC<unknown>HIDDEN2
              __GI_strchrnul.symtab0x8052ab425FUNC<unknown>HIDDEN2
              __GI_strcmp.symtab0x8052ad029FUNC<unknown>HIDDEN2
              __GI_strcoll.symtab0x8052ad029FUNC<unknown>HIDDEN2
              __GI_strcspn.symtab0x8052bc045FUNC<unknown>HIDDEN2
              __GI_strlen.symtab0x804e83c19FUNC<unknown>HIDDEN2
              __GI_strnlen.symtab0x804e85024FUNC<unknown>HIDDEN2
              __GI_strrchr.symtab0x8052af026FUNC<unknown>HIDDEN2
              __GI_strspn.symtab0x8052bf042FUNC<unknown>HIDDEN2
              __GI_sysconf.symtab0x8050238523FUNC<unknown>HIDDEN2
              __GI_tcgetattr.symtab0x8052c3896FUNC<unknown>HIDDEN2
              __GI_time.symtab0x804d70416FUNC<unknown>HIDDEN2
              __GI_times.symtab0x805105016FUNC<unknown>HIDDEN2
              __GI_unlink.symtab0x804d71439FUNC<unknown>HIDDEN2
              __GI_vsnprintf.symtab0x804da0c172FUNC<unknown>HIDDEN2
              __GI_wcrtomb.symtab0x80514d863FUNC<unknown>HIDDEN2
              __GI_wcsnrtombs.symtab0x8051534128FUNC<unknown>HIDDEN2
              __GI_wcsrtombs.symtab0x805151827FUNC<unknown>HIDDEN2
              __GI_write.symtab0x805088091FUNC<unknown>HIDDEN2
              __JCR_END__.symtab0x80569880OBJECT<unknown>DEFAULT9
              __JCR_LIST__.symtab0x80569880OBJECT<unknown>DEFAULT9
              __app_fini.symtab0x80571b04OBJECT<unknown>HIDDEN12
              __atexit_lock.symtab0x8056a9024OBJECT<unknown>DEFAULT11
              __bss_start.symtab0x8056ba40NOTYPE<unknown>DEFAULTSHN_ABS
              __check_one_fd.symtab0x8050a4b44FUNC<unknown>DEFAULT2
              __close.symtab0x80507d080FUNC<unknown>DEFAULT2
              __close_nocancel.symtab0x80507da27FUNC<unknown>DEFAULT2
              __ctype_b.symtab0x8056ab84OBJECT<unknown>DEFAULT11
              __curbrk.symtab0x80597144OBJECT<unknown>HIDDEN12
              __deregister_frame_info_bases.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              __do_global_ctors_aux.symtab0x80535e00FUNC<unknown>DEFAULT2
              __do_global_dtors_aux.symtab0x80480e00FUNC<unknown>DEFAULT2
              __dso_handle.symtab0x80569980OBJECT<unknown>HIDDEN11
              __environ.symtab0x80571a84OBJECT<unknown>DEFAULT12
              __errno_location.symtab0x804d9b813FUNC<unknown>DEFAULT2
              __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __exit_cleanup.symtab0x8056c584OBJECT<unknown>HIDDEN12
              __fcntl_nocancel.symtab0x804d3e883FUNC<unknown>DEFAULT2
              __fgetc_unlocked.symtab0x8052940204FUNC<unknown>DEFAULT2
              __fini_array_end.symtab0x80569780NOTYPE<unknown>HIDDEN6
              __fini_array_start.symtab0x80569780NOTYPE<unknown>HIDDEN6
              __fork.symtab0x8050444524FUNC<unknown>DEFAULT2
              __fork_generation_pointer.symtab0x8059b884OBJECT<unknown>HIDDEN12
              __fork_handlers.symtab0x8059b8c4OBJECT<unknown>HIDDEN12
              __fork_lock.symtab0x8056c5c4OBJECT<unknown>HIDDEN12
              __get_pc_thunk_bx.symtab0x80480d00FUNC<unknown>HIDDEN2
              __getdents.symtab0x8050e3c131FUNC<unknown>HIDDEN2
              __getdents64.symtab0x80530fc280FUNC<unknown>HIDDEN2
              __getpagesize.symtab0x8050ef819FUNC<unknown>DEFAULT2
              __getpid.symtab0x805067049FUNC<unknown>DEFAULT2
              __glibc_strerror_r.symtab0x804e86826FUNC<unknown>DEFAULT2
              __glibc_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __h_errno_location.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              __init_array_end.symtab0x80569780NOTYPE<unknown>HIDDEN6
              __init_array_start.symtab0x80569780NOTYPE<unknown>HIDDEN6
              __libc_accept.symtab0x804e96484FUNC<unknown>DEFAULT2
              __libc_close.symtab0x80507d080FUNC<unknown>DEFAULT2
              __libc_connect.symtab0x804e9e084FUNC<unknown>DEFAULT2
              __libc_disable_asynccancel.symtab0x805093c86FUNC<unknown>HIDDEN2
              __libc_enable_asynccancel.symtab0x805099279FUNC<unknown>HIDDEN2
              __libc_errno.symtab0x04TLS<unknown>HIDDEN6
              __libc_fcntl.symtab0x804d43b153FUNC<unknown>DEFAULT2
              __libc_fork.symtab0x8050444524FUNC<unknown>DEFAULT2
              __libc_h_errno.symtab0x44TLS<unknown>HIDDEN6
              __libc_nanosleep.symtab0x8050fd161FUNC<unknown>DEFAULT2
              __libc_open.symtab0x805082091FUNC<unknown>DEFAULT2
              __libc_read.symtab0x80508e091FUNC<unknown>DEFAULT2
              __libc_recv.symtab0x804ea9492FUNC<unknown>DEFAULT2
              __libc_recvfrom.symtab0x804eaf0108FUNC<unknown>DEFAULT2
              __libc_select.symtab0x804d611108FUNC<unknown>DEFAULT2
              __libc_send.symtab0x804eb5c92FUNC<unknown>DEFAULT2
              __libc_sendto.symtab0x804ebb8108FUNC<unknown>DEFAULT2
              __libc_setup_tls.symtab0x8052dda513FUNC<unknown>DEFAULT2
              __libc_sigaction.symtab0x8050cff80FUNC<unknown>DEFAULT2
              __libc_stack_end.symtab0x80571a44OBJECT<unknown>DEFAULT12
              __libc_write.symtab0x805088091FUNC<unknown>DEFAULT2
              __lll_lock_wait_private.symtab0x8052d3040FUNC<unknown>HIDDEN2
              __lll_unlock_wake_private.symtab0x8052d6032FUNC<unknown>HIDDEN2
              __malloc_consolidate.symtab0x804f9bd379FUNC<unknown>HIDDEN2
              __malloc_largebin_index.symtab0x804eda838FUNC<unknown>DEFAULT2
              __malloc_lock.symtab0x80569b424OBJECT<unknown>DEFAULT11
              __malloc_state.symtab0x8059810888OBJECT<unknown>DEFAULT12
              __malloc_trim.symtab0x804f940125FUNC<unknown>DEFAULT2
              __nptl_deallocate_tsd.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              __nptl_nthreads.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              __open.symtab0x805082091FUNC<unknown>DEFAULT2
              __open_nocancel.symtab0x805082a33FUNC<unknown>DEFAULT2
              __pagesize.symtab0x80571ac4OBJECT<unknown>DEFAULT12
              __preinit_array_end.symtab0x80569780NOTYPE<unknown>HIDDEN6
              __preinit_array_start.symtab0x80569780NOTYPE<unknown>HIDDEN6
              __progname.symtab0x8056aac4OBJECT<unknown>DEFAULT11
              __progname_full.symtab0x8056ab04OBJECT<unknown>DEFAULT11
              __pthread_initialize_minimal.symtab0x8052fdb15FUNC<unknown>DEFAULT2
              __pthread_mutex_init.symtab0x80509e73FUNC<unknown>DEFAULT2
              __pthread_mutex_lock.symtab0x80509e43FUNC<unknown>DEFAULT2
              __pthread_mutex_trylock.symtab0x80509e43FUNC<unknown>DEFAULT2
              __pthread_mutex_unlock.symtab0x80509e43FUNC<unknown>DEFAULT2
              __pthread_return_0.symtab0x80509e43FUNC<unknown>DEFAULT2
              __pthread_unwind.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              __read.symtab0x80508e091FUNC<unknown>DEFAULT2
              __read_nocancel.symtab0x80508ea33FUNC<unknown>DEFAULT2
              __register_frame_info_bases.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              __restore.symtab0x8050cf70NOTYPE<unknown>DEFAULT2
              __restore_rt.symtab0x8050cf00NOTYPE<unknown>DEFAULT2
              __rtld_fini.symtab0x80571b44OBJECT<unknown>HIDDEN12
              __sigaddset.symtab0x804ed6832FUNC<unknown>DEFAULT2
              __sigdelset.symtab0x804ed8832FUNC<unknown>DEFAULT2
              __sigismember.symtab0x804ed4436FUNC<unknown>DEFAULT2
              __socketcall.symtab0x8050d9043FUNC<unknown>HIDDEN2
              __socketcall.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __stdin.symtab0x8056ac84OBJECT<unknown>DEFAULT11
              __stdio_READ.symtab0x805333c62FUNC<unknown>HIDDEN2
              __stdio_WRITE.symtab0x805337c139FUNC<unknown>HIDDEN2
              __stdio_adjust_position.symtab0x8053408154FUNC<unknown>HIDDEN2
              __stdio_fwrite.symtab0x8051a74232FUNC<unknown>HIDDEN2
              __stdio_rfill.symtab0x80534a437FUNC<unknown>HIDDEN2
              __stdio_seek.symtab0x805352846FUNC<unknown>HIDDEN2
              __stdio_trans2r_o.symtab0x80534cc92FUNC<unknown>HIDDEN2
              __stdio_trans2w_o.symtab0x8051c68154FUNC<unknown>HIDDEN2
              __stdio_wcommit.symtab0x8051d0437FUNC<unknown>HIDDEN2
              __stdout.symtab0x8056acc4OBJECT<unknown>DEFAULT11
              __syscall_error.symtab0x8050ce015FUNC<unknown>HIDDEN2
              __syscall_error.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __syscall_nanosleep.symtab0x8050fa841FUNC<unknown>DEFAULT2
              __syscall_rt_sigaction.symtab0x8050dbc53FUNC<unknown>DEFAULT2
              __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __syscall_select.symtab0x804d5d857FUNC<unknown>DEFAULT2
              __uClibc_fini.symtab0x8050a1356FUNC<unknown>DEFAULT2
              __uClibc_init.symtab0x8050a7739FUNC<unknown>DEFAULT2
              __uClibc_main.symtab0x8050a9e577FUNC<unknown>DEFAULT2
              __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __uclibc_progname.symtab0x8056aa84OBJECT<unknown>HIDDEN11
              __write.symtab0x805088091FUNC<unknown>DEFAULT2
              __write_nocancel.symtab0x805088a33FUNC<unknown>DEFAULT2
              __xpg_strerror_r.symtab0x804e884191FUNC<unknown>DEFAULT2
              __xpg_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __xstat32_conv.symtab0x8051103138FUNC<unknown>HIDDEN2
              __xstat64_conv.symtab0x8051060163FUNC<unknown>HIDDEN2
              _adjust_pos.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _bss_custom_printf_spec.symtab0x8056c4810OBJECT<unknown>DEFAULT12
              _charpad.symtab0x804dab853FUNC<unknown>DEFAULT2
              _cs_funcs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _custom_printf_arginfo.symtab0x80597b840OBJECT<unknown>HIDDEN12
              _custom_printf_handler.symtab0x80597e040OBJECT<unknown>HIDDEN12
              _custom_printf_spec.symtab0x80569b04OBJECT<unknown>HIDDEN11
              _dl_aux_init.symtab0x8052fec18FUNC<unknown>DEFAULT2
              _dl_nothread_init_static_tls.symtab0x8052ffe68FUNC<unknown>HIDDEN2
              _dl_phdr.symtab0x8059bb04OBJECT<unknown>DEFAULT12
              _dl_phnum.symtab0x8059bb44OBJECT<unknown>DEFAULT12
              _dl_tls_dtv_gaps.symtab0x8059ba41OBJECT<unknown>DEFAULT12
              _dl_tls_dtv_slotinfo_list.symtab0x8059ba04OBJECT<unknown>DEFAULT12
              _dl_tls_generation.symtab0x8059ba84OBJECT<unknown>DEFAULT12
              _dl_tls_max_dtv_idx.symtab0x8059b984OBJECT<unknown>DEFAULT12
              _dl_tls_setup.symtab0x8052daa48FUNC<unknown>DEFAULT2
              _dl_tls_static_align.symtab0x8059b944OBJECT<unknown>DEFAULT12
              _dl_tls_static_nelem.symtab0x8059bac4OBJECT<unknown>DEFAULT12
              _dl_tls_static_size.symtab0x8059b9c4OBJECT<unknown>DEFAULT12
              _dl_tls_static_used.symtab0x8059b904OBJECT<unknown>DEFAULT12
              _edata.symtab0x8056ba40NOTYPE<unknown>DEFAULTSHN_ABS
              _end.symtab0x8059bb80NOTYPE<unknown>DEFAULTSHN_ABS
              _exit.symtab0x804d4d466FUNC<unknown>DEFAULT2
              _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _fini.symtab0x80536070FUNC<unknown>DEFAULT3
              _fixed_buffers.symtab0x80571d88192OBJECT<unknown>DEFAULT12
              _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _fp_out_narrow.symtab0x804daed94FUNC<unknown>DEFAULT2
              _fpmaxtostr.symtab0x8051ea81479FUNC<unknown>HIDDEN2
              _fpmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _fwrite.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _init.symtab0x80480b40FUNC<unknown>DEFAULT1
              _load_inttype.symtab0x8051d2c86FUNC<unknown>HIDDEN2
              _load_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _ppfs_init.symtab0x804e148103FUNC<unknown>HIDDEN2
              _ppfs_init.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _ppfs_parsespec.symtab0x804e32d1036FUNC<unknown>HIDDEN2
              _ppfs_parsespec.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _ppfs_prepargs.symtab0x804e1b057FUNC<unknown>HIDDEN2
              _ppfs_prepargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _ppfs_setargs.symtab0x804e1ec277FUNC<unknown>HIDDEN2
              _ppfs_setargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _promoted_size.symtab0x804e30441FUNC<unknown>DEFAULT2
              _pthread_cleanup_pop_restore.symtab0x80509fc23FUNC<unknown>DEFAULT2
              _pthread_cleanup_push_defer.symtab0x80509ea18FUNC<unknown>DEFAULT2
              _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _setjmp.symtab0x8050d5034FUNC<unknown>DEFAULT2
              _sigintr.symtab0x80598088OBJECT<unknown>HIDDEN12
              _start.symtab0x804818434FUNC<unknown>DEFAULT2
              _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _stdio_fopen.symtab0x80517a0664FUNC<unknown>HIDDEN2
              _stdio_init.symtab0x8051b5c59FUNC<unknown>HIDDEN2
              _stdio_openlist.symtab0x8056ad04OBJECT<unknown>DEFAULT11
              _stdio_openlist_add_lock.symtab0x80571b812OBJECT<unknown>DEFAULT12
              _stdio_openlist_dec_use.symtab0x80525a4320FUNC<unknown>HIDDEN2
              _stdio_openlist_del_count.symtab0x80571d44OBJECT<unknown>DEFAULT12
              _stdio_openlist_del_lock.symtab0x80571c412OBJECT<unknown>DEFAULT12
              _stdio_openlist_use_count.symtab0x80571d04OBJECT<unknown>DEFAULT12
              _stdio_streams.symtab0x8056ad8204OBJECT<unknown>DEFAULT11
              _stdio_term.symtab0x8051b97208FUNC<unknown>HIDDEN2
              _stdio_user_locking.symtab0x8056ad44OBJECT<unknown>DEFAULT11
              _store_inttype.symtab0x8051d8461FUNC<unknown>HIDDEN2
              _store_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _string_syserrmsgs.symtab0x80540842906OBJECT<unknown>HIDDEN4
              _string_syserrmsgs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _trans2w.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _uintmaxtostr.symtab0x8051dc4228FUNC<unknown>HIDDEN2
              _uintmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _vfprintf_internal.symtab0x804db4b1530FUNC<unknown>HIDDEN2
              _vfprintf_internal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              abort.symtab0x804fce4191FUNC<unknown>DEFAULT2
              abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              accept.symtab0x804e96484FUNC<unknown>DEFAULT2
              accept.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              anti_gdb_entry.symtab0x804bc4011FUNC<unknown>DEFAULT2
              attack.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              attack_get_opt_int.symtab0x80486a0109FUNC<unknown>DEFAULT2
              attack_get_opt_ip.symtab0x8048630101FUNC<unknown>DEFAULT2
              attack_gre_ip.symtab0x804a5501242FUNC<unknown>DEFAULT2
              attack_init.symtab0x8048710772FUNC<unknown>DEFAULT2
              attack_kill_all.symtab0x8048270326FUNC<unknown>DEFAULT2
              attack_method_nudp.symtab0x804b3201350FUNC<unknown>DEFAULT2
              attack_method_tcp.symtab0x80494e01350FUNC<unknown>DEFAULT2
              attack_ongoing.symtab0x8056c0032OBJECT<unknown>DEFAULT12
              attack_parse.symtab0x80483c0613FUNC<unknown>DEFAULT2
              attack_start.symtab0x80481b0192FUNC<unknown>DEFAULT2
              attack_tcp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              attack_tcp_ack.symtab0x8049f901471FUNC<unknown>DEFAULT2
              attack_tcp_bypass.symtab0x8048f901350FUNC<unknown>DEFAULT2
              attack_tcp_null.symtab0x804aa301572FUNC<unknown>DEFAULT2
              attack_tcp_sack2.symtab0x8049a301367FUNC<unknown>DEFAULT2
              attack_tcp_syn.symtab0x8048a201391FUNC<unknown>DEFAULT2
              attack_udp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              attack_udp_plain.symtab0x804b070683FUNC<unknown>DEFAULT2
              been_there_done_that.symtab0x8056c541OBJECT<unknown>DEFAULT12
              bind.symtab0x804e9b840FUNC<unknown>DEFAULT2
              bind.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              brk.symtab0x805304444FUNC<unknown>DEFAULT2
              brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              bsd_signal.symtab0x804ecbc136FUNC<unknown>DEFAULT2
              calloc.symtab0x804f558236FUNC<unknown>DEFAULT2
              calloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              chdir.symtab0x804d51839FUNC<unknown>DEFAULT2
              chdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              checksum.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              checksum_generic.symtab0x804b87070FUNC<unknown>DEFAULT2
              checksum_tcpudp.symtab0x804b8c0169FUNC<unknown>DEFAULT2
              clock.symtab0x804d9c834FUNC<unknown>DEFAULT2
              clock.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              close.symtab0x80507d080FUNC<unknown>DEFAULT2
              closedir.symtab0x804d73c130FUNC<unknown>DEFAULT2
              closedir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              completed.4963.symtab0x8056bc01OBJECT<unknown>DEFAULT12
              connect.symtab0x804e9e084FUNC<unknown>DEFAULT2
              connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              entries.symtab0x80597604OBJECT<unknown>DEFAULT12
              environ.symtab0x80571a84OBJECT<unknown>DEFAULT12
              errno.symtab0x04TLS<unknown>DEFAULT6
              errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              exit.symtab0x805011493FUNC<unknown>DEFAULT2
              exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              exp10_table.symtab0x8055320156OBJECT<unknown>DEFAULT4
              fclose.symtab0x80515b4380FUNC<unknown>DEFAULT2
              fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fcntl.symtab0x804d43b153FUNC<unknown>DEFAULT2
              fd_ctrl.symtab0x80569a04OBJECT<unknown>DEFAULT11
              fd_serv.symtab0x80569a44OBJECT<unknown>DEFAULT11
              fd_to_DIR.symtab0x804d7c0136FUNC<unknown>DEFAULT2
              fdopendir.symtab0x804d8cc108FUNC<unknown>DEFAULT2
              fflush_unlocked.symtab0x80526e4447FUNC<unknown>DEFAULT2
              fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fgetc.symtab0x8052470145FUNC<unknown>DEFAULT2
              fgetc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fgetc_unlocked.symtab0x8052940204FUNC<unknown>DEFAULT2
              fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fgets.symtab0x8052518118FUNC<unknown>DEFAULT2
              fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fgets_unlocked.symtab0x8052a0c94FUNC<unknown>DEFAULT2
              fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fmt.symtab0x805530020OBJECT<unknown>DEFAULT4
              fopen.symtab0x805178821FUNC<unknown>DEFAULT2
              fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fork.symtab0x8050444524FUNC<unknown>DEFAULT2
              fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fork_handler_pool.symtab0x8056c601348OBJECT<unknown>DEFAULT12
              fputs_unlocked.symtab0x804e73c45FUNC<unknown>DEFAULT2
              fputs_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              frame_dummy.symtab0x80481300FUNC<unknown>DEFAULT2
              free.symtab0x804fb38399FUNC<unknown>DEFAULT2
              free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fseek.symtab0x805321424FUNC<unknown>DEFAULT2
              fseeko.symtab0x805321424FUNC<unknown>DEFAULT2
              fseeko.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fseeko64.symtab0x805322c246FUNC<unknown>DEFAULT2
              fseeko64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fstat.symtab0x8050df470FUNC<unknown>DEFAULT2
              fstat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fwrite_unlocked.symtab0x804e76c111FUNC<unknown>DEFAULT2
              fwrite_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getc.symtab0x8052470145FUNC<unknown>DEFAULT2
              getc_unlocked.symtab0x8052940204FUNC<unknown>DEFAULT2
              getdents.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getdents64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getdtablesize.symtab0x8050ec032FUNC<unknown>DEFAULT2
              getdtablesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getegid.symtab0x8050ee08FUNC<unknown>DEFAULT2
              getegid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              geteuid.symtab0x8050ee88FUNC<unknown>DEFAULT2
              geteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getgid.symtab0x8050ef08FUNC<unknown>DEFAULT2
              getgid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getpagesize.symtab0x8050ef819FUNC<unknown>DEFAULT2
              getpagesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getpid.symtab0x805067049FUNC<unknown>DEFAULT2
              getpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getppid.symtab0x804d5408FUNC<unknown>DEFAULT2
              getppid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getrlimit.symtab0x8050f0c43FUNC<unknown>DEFAULT2
              getrlimit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getsockname.symtab0x804ea3440FUNC<unknown>DEFAULT2
              getsockname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getsockopt.symtab0x804ea5c56FUNC<unknown>DEFAULT2
              getsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getuid.symtab0x8050f388FUNC<unknown>DEFAULT2
              getuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              h_errno.symtab0x44TLS<unknown>DEFAULT6
              httpd_port.symtab0x8056c284OBJECT<unknown>DEFAULT12
              httpd_started.symtab0x8056c2c4OBJECT<unknown>DEFAULT12
              id_buf.symtab0x805974032OBJECT<unknown>DEFAULT12
              index.symtab0x8052a9430FUNC<unknown>DEFAULT2
              inet_addr.symtab0x804e94431FUNC<unknown>DEFAULT2
              inet_aton.symtab0x8052c98148FUNC<unknown>DEFAULT2
              inet_aton.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              inet_makeaddr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              init_static_tls.symtab0x8052d8042FUNC<unknown>DEFAULT2
              initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              initstate.symtab0x804fe4585FUNC<unknown>DEFAULT2
              initstate_r.symtab0x804ffd7155FUNC<unknown>DEFAULT2
              ioctl.symtab0x8053070139FUNC<unknown>DEFAULT2
              ioctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              isatty.symtab0x8052c1c27FUNC<unknown>DEFAULT2
              isatty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              kill.symtab0x804d54843FUNC<unknown>DEFAULT2
              kill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              killer.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              killer_init.symtab0x804bb50232FUNC<unknown>DEFAULT2
              killer_kill.symtab0x804b97029FUNC<unknown>DEFAULT2
              killer_mirai_exists.symtab0x804b9f0347FUNC<unknown>DEFAULT2
              killer_pid.symtab0x8056c204OBJECT<unknown>DEFAULT12
              libc-cancellation.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              libc-tls.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              llseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              lockdown.symtab0x80597284OBJECT<unknown>DEFAULT12
              lseek64.symtab0x805357890FUNC<unknown>DEFAULT2
              main.symtab0x804bce02744FUNC<unknown>DEFAULT2
              main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              main_pid.symtab0x80597644OBJECT<unknown>DEFAULT12
              malloc.symtab0x804edce1928FUNC<unknown>DEFAULT2
              malloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              malloc_trim.symtab0x804fcc729FUNC<unknown>DEFAULT2
              memcpy.symtab0x804e7dc41FUNC<unknown>DEFAULT2
              memcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              memmove.symtab0x8052a6c37FUNC<unknown>DEFAULT2
              memmove.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              mempcpy.symtab0x805355830FUNC<unknown>DEFAULT2
              mempcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              memrchr.symtab0x8052b0c177FUNC<unknown>DEFAULT2
              memrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              memset.symtab0x804e80850FUNC<unknown>DEFAULT2
              memset.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              methods.symtab0x8056be04OBJECT<unknown>DEFAULT12
              methods_len.symtab0x8056bdc1OBJECT<unknown>DEFAULT12
              mmap.symtab0x8050d7427FUNC<unknown>DEFAULT2
              mremap.symtab0x8050f4059FUNC<unknown>DEFAULT2
              mremap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              munmap.symtab0x8050f7c43FUNC<unknown>DEFAULT2
              munmap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              mylock.symtab0x80569cc24OBJECT<unknown>DEFAULT11
              mylock.symtab0x80569e424OBJECT<unknown>DEFAULT11
              nanosleep.symtab0x8050fd161FUNC<unknown>DEFAULT2
              nanosleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              nprocessors_onln.symtab0x8050174196FUNC<unknown>DEFAULT2
              object.4975.symtab0x8056bc424OBJECT<unknown>DEFAULT12
              open.symtab0x805082091FUNC<unknown>DEFAULT2
              opendir.symtab0x804d848132FUNC<unknown>DEFAULT2
              opendir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              p.4961.symtab0x805699c0OBJECT<unknown>DEFAULT11
              parse_config.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              pending_connection.symtab0x8056c301OBJECT<unknown>DEFAULT12
              pgid.symtab0x8056c344OBJECT<unknown>DEFAULT12
              pipe.symtab0x804d57439FUNC<unknown>DEFAULT2
              pipe.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              prctl.symtab0x804d59c59FUNC<unknown>DEFAULT2
              prctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              prefix.6454.symtab0x8053fdc12OBJECT<unknown>DEFAULT4
              program_invocation_name.symtab0x8056ab04OBJECT<unknown>DEFAULT11
              program_invocation_short_name.symtab0x8056aac4OBJECT<unknown>DEFAULT11
              protect_d.symtab0x804b99087FUNC<unknown>DEFAULT2
              pseudo_cancel.symtab0x80507f50NOTYPE<unknown>DEFAULT2
              pseudo_cancel.symtab0x805084b0NOTYPE<unknown>DEFAULT2
              pseudo_cancel.symtab0x80508ab0NOTYPE<unknown>DEFAULT2
              pseudo_cancel.symtab0x805090b0NOTYPE<unknown>DEFAULT2
              pseudo_end.symtab0x805081f0NOTYPE<unknown>DEFAULT2
              pseudo_end.symtab0x805087a0NOTYPE<unknown>DEFAULT2
              pseudo_end.symtab0x80508da0NOTYPE<unknown>DEFAULT2
              pseudo_end.symtab0x805093a0NOTYPE<unknown>DEFAULT2
              qual_chars.6463.symtab0x8053ff020OBJECT<unknown>DEFAULT4
              raise.symtab0x80506a4100FUNC<unknown>DEFAULT2
              raise.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              rand.symtab0x804fda45FUNC<unknown>DEFAULT2
              rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              rand_alphastr.symtab0x804c820268FUNC<unknown>DEFAULT2
              rand_init.symtab0x804c7e063FUNC<unknown>DEFAULT2
              rand_next.symtab0x804c7a064FUNC<unknown>DEFAULT2
              rand_str.symtab0x804c930218FUNC<unknown>DEFAULT2
              random.symtab0x804fdac66FUNC<unknown>DEFAULT2
              random.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              random_poly_info.symtab0x8054be010OBJECT<unknown>DEFAULT4
              random_r.symtab0x804fed895FUNC<unknown>DEFAULT2
              random_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              randtbl.symtab0x8056a10128OBJECT<unknown>DEFAULT11
              read.symtab0x80508e091FUNC<unknown>DEFAULT2
              readdir.symtab0x804d938127FUNC<unknown>DEFAULT2
              readdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              readdir64.symtab0x8051190129FUNC<unknown>DEFAULT2
              readdir64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              readlink.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              realloc.symtab0x804f644763FUNC<unknown>DEFAULT2
              realloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              recv.symtab0x804ea9492FUNC<unknown>DEFAULT2
              recv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              recvfrom.symtab0x804eaf0108FUNC<unknown>DEFAULT2
              recvfrom.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              register-atfork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              remove.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              resolv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              resolv_entries_free.symtab0x804ca1052FUNC<unknown>DEFAULT2
              resolv_lookup.symtab0x804ca501192FUNC<unknown>DEFAULT2
              resolve_cnc_addr.symtab0x804bc50135FUNC<unknown>DEFAULT2
              resolve_func.symtab0x80569a84OBJECT<unknown>DEFAULT11
              rindex.symtab0x8052af026FUNC<unknown>DEFAULT2
              rmdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              sbrk.symtab0x805101064FUNC<unknown>DEFAULT2
              sbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              select.symtab0x804d611108FUNC<unknown>DEFAULT2
              select.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              send.symtab0x804eb5c92FUNC<unknown>DEFAULT2
              send.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              sendto.symtab0x804ebb8108FUNC<unknown>DEFAULT2
              sendto.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              setsid.symtab0x804d68031FUNC<unknown>DEFAULT2
              setsid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              setsockopt.symtab0x804ec2456FUNC<unknown>DEFAULT2
              setsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              setstate.symtab0x804fdee87FUNC<unknown>DEFAULT2
              setstate_r.symtab0x8050072161FUNC<unknown>DEFAULT2
              sigaction.symtab0x8050cff80FUNC<unknown>DEFAULT2
              sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              sigaddset.symtab0x804ec8434FUNC<unknown>DEFAULT2
              sigaddset.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              sigempty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              sigemptyset.symtab0x804eca820FUNC<unknown>DEFAULT2
              signal.symtab0x804ecbc136FUNC<unknown>DEFAULT2
              signal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              sigprocmask.symtab0x804d6a097FUNC<unknown>DEFAULT2
              sigprocmask.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              sigsetops.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              sleep.symtab0x8050708195FUNC<unknown>DEFAULT2
              sleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              socket.symtab0x804ec5c40FUNC<unknown>DEFAULT2
              socket.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              spec_and_mask.6462.symtab0x805400416OBJECT<unknown>DEFAULT4
              spec_base.6453.symtab0x8053fe87OBJECT<unknown>DEFAULT4
              spec_chars.6459.symtab0x805405421OBJECT<unknown>DEFAULT4
              spec_flags.6458.symtab0x805406c8OBJECT<unknown>DEFAULT4
              spec_or_mask.6461.symtab0x805401416OBJECT<unknown>DEFAULT4
              spec_ranges.6460.symtab0x80540249OBJECT<unknown>DEFAULT4
              sprintf.symtab0x804d9ec30FUNC<unknown>DEFAULT2
              sprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              srand.symtab0x804fe9a61FUNC<unknown>DEFAULT2
              srandom.symtab0x804fe9a61FUNC<unknown>DEFAULT2
              srandom_r.symtab0x804ff37160FUNC<unknown>DEFAULT2
              srv_addr.symtab0x805976816OBJECT<unknown>DEFAULT12
              static_dtv.symtab0x80591d8512OBJECT<unknown>DEFAULT12
              static_map.symtab0x80596e052OBJECT<unknown>DEFAULT12
              static_slotinfo.symtab0x80593d8776OBJECT<unknown>DEFAULT12
              stderr.symtab0x8056ac44OBJECT<unknown>DEFAULT11
              stdin.symtab0x8056abc4OBJECT<unknown>DEFAULT11
              stdout.symtab0x8056ac04OBJECT<unknown>DEFAULT11
              strchr.symtab0x8052a9430FUNC<unknown>DEFAULT2
              strchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              strchrnul.symtab0x8052ab425FUNC<unknown>DEFAULT2
              strchrnul.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              strcmp.symtab0x8052ad029FUNC<unknown>DEFAULT2
              strcmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              strcoll.symtab0x8052ad029FUNC<unknown>DEFAULT2
              strcspn.symtab0x8052bc045FUNC<unknown>DEFAULT2
              strcspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              strerror_r.symtab0x804e884191FUNC<unknown>DEFAULT2
              strlen.symtab0x804e83c19FUNC<unknown>DEFAULT2
              strlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              strnlen.symtab0x804e85024FUNC<unknown>DEFAULT2
              strnlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              strrchr.symtab0x8052af026FUNC<unknown>DEFAULT2
              strrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              strspn.symtab0x8052bf042FUNC<unknown>DEFAULT2
              strspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              sysconf.symtab0x8050238523FUNC<unknown>DEFAULT2
              sysconf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              table.symtab0x805978056OBJECT<unknown>DEFAULT12
              table.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              table_init.symtab0x804d030274FUNC<unknown>DEFAULT2
              table_key.symtab0x80569ac4OBJECT<unknown>DEFAULT11
              table_lock_val.symtab0x804cf30114FUNC<unknown>DEFAULT2
              table_retrieve_val.symtab0x804cf0038FUNC<unknown>DEFAULT2
              table_unlock_val.symtab0x804cfb0114FUNC<unknown>DEFAULT2
              tcgetattr.symtab0x8052c3896FUNC<unknown>DEFAULT2
              tcgetattr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              tcp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              time.symtab0x804d70416FUNC<unknown>DEFAULT2
              time.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              times.symtab0x805105016FUNC<unknown>DEFAULT2
              times.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              type_codes.symtab0x805403024OBJECT<unknown>DEFAULT4
              type_sizes.symtab0x805404812OBJECT<unknown>DEFAULT4
              unknown.1474.symtab0x805407414OBJECT<unknown>DEFAULT4
              unlink.symtab0x804d71439FUNC<unknown>DEFAULT2
              unlink.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              unsafe_state.symtab0x80569fc20OBJECT<unknown>DEFAULT11
              update_process.symtab0x804b0601FUNC<unknown>DEFAULT2
              updating.symtab0x8056c244OBJECT<unknown>DEFAULT12
              util.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              util_atoi.symtab0x804d2f0245FUNC<unknown>DEFAULT2
              util_isalpha.symtab0x804d23027FUNC<unknown>DEFAULT2
              util_isdigit.symtab0x804d25018FUNC<unknown>DEFAULT2
              util_local_addr.symtab0x804d270120FUNC<unknown>DEFAULT2
              util_memcpy.symtab0x804d1e034FUNC<unknown>DEFAULT2
              util_strcat.symtab0x804d17044FUNC<unknown>DEFAULT2
              util_strcpy.symtab0x804d1a050FUNC<unknown>DEFAULT2
              util_strlen.symtab0x804d15024FUNC<unknown>DEFAULT2
              util_zero.symtab0x804d21026FUNC<unknown>DEFAULT2
              vsnprintf.symtab0x804da0c172FUNC<unknown>DEFAULT2
              vsnprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              w.symtab0x8056c444OBJECT<unknown>DEFAULT12
              wcrtomb.symtab0x80514d863FUNC<unknown>DEFAULT2
              wcrtomb.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              wcsnrtombs.symtab0x8051534128FUNC<unknown>DEFAULT2
              wcsnrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              wcsrtombs.symtab0x805151827FUNC<unknown>DEFAULT2
              wcsrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              write.symtab0x805088091FUNC<unknown>DEFAULT2
              x.symtab0x8056c384OBJECT<unknown>DEFAULT12
              xstatconv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              y.symtab0x8056c3c4OBJECT<unknown>DEFAULT12
              z.symtab0x8056c404OBJECT<unknown>DEFAULT12

              Network Behavior

              Download Network PCAP: filtered – full

              Suricata IDS Alerts

              TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
              2025-04-20T19:18:29.328130+02002030491ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)1192.168.2.1545212107.189.28.12758431TCP
              2025-04-20T19:18:29.605398+02002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response1107.189.28.12758431192.168.2.1545212TCP
              2025-04-20T19:18:39.679286+02002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response1107.189.28.12758431192.168.2.1545212TCP
              2025-04-20T19:18:59.683618+02002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response1107.189.28.12758431192.168.2.1545212TCP
              2025-04-20T19:19:19.687591+02002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response1107.189.28.12758431192.168.2.1545212TCP
              2025-04-20T19:19:39.691862+02002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response1107.189.28.12758431192.168.2.1545212TCP
              2025-04-20T19:19:59.696930+02002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response1107.189.28.12758431192.168.2.1545212TCP
              2025-04-20T19:20:19.702879+02002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response1107.189.28.12758431192.168.2.1545212TCP

              Network Port Distribution

              • Total Packets: 13
              • • 58431 undefined
              • • 53 (DNS)
              TimestampSource PortDest PortSource IPDest IP
              Apr 20, 2025 19:18:29.052962065 CEST4521258431192.168.2.15107.189.28.127
              Apr 20, 2025 19:18:29.327956915 CEST5843145212107.189.28.127192.168.2.15
              Apr 20, 2025 19:18:29.328053951 CEST4521258431192.168.2.15107.189.28.127
              Apr 20, 2025 19:18:29.328130007 CEST4521258431192.168.2.15107.189.28.127
              Apr 20, 2025 19:18:29.603238106 CEST5843145212107.189.28.127192.168.2.15
              Apr 20, 2025 19:18:29.605397940 CEST5843145212107.189.28.127192.168.2.15
              Apr 20, 2025 19:18:29.605524063 CEST4521258431192.168.2.15107.189.28.127
              Apr 20, 2025 19:18:39.612292051 CEST4521258431192.168.2.15107.189.28.127
              Apr 20, 2025 19:18:39.679286003 CEST5843145212107.189.28.127192.168.2.15
              Apr 20, 2025 19:18:39.679442883 CEST4521258431192.168.2.15107.189.28.127
              Apr 20, 2025 19:18:39.928584099 CEST5843145212107.189.28.127192.168.2.15
              Apr 20, 2025 19:18:59.683618069 CEST5843145212107.189.28.127192.168.2.15
              Apr 20, 2025 19:18:59.683739901 CEST4521258431192.168.2.15107.189.28.127
              Apr 20, 2025 19:19:19.687591076 CEST5843145212107.189.28.127192.168.2.15
              Apr 20, 2025 19:19:19.687738895 CEST4521258431192.168.2.15107.189.28.127
              Apr 20, 2025 19:19:39.691862106 CEST5843145212107.189.28.127192.168.2.15
              Apr 20, 2025 19:19:39.692030907 CEST4521258431192.168.2.15107.189.28.127
              Apr 20, 2025 19:19:59.696929932 CEST5843145212107.189.28.127192.168.2.15
              Apr 20, 2025 19:19:59.697171926 CEST4521258431192.168.2.15107.189.28.127
              Apr 20, 2025 19:20:19.702878952 CEST5843145212107.189.28.127192.168.2.15
              Apr 20, 2025 19:20:19.702986956 CEST4521258431192.168.2.15107.189.28.127
              Apr 20, 2025 19:20:29.712869883 CEST4521258431192.168.2.15107.189.28.127
              Apr 20, 2025 19:20:29.987806082 CEST5843145212107.189.28.127192.168.2.15
              TimestampSource PortDest PortSource IPDest IP
              Apr 20, 2025 19:18:28.894866943 CEST3760153192.168.2.158.8.8.8
              Apr 20, 2025 19:18:29.052750111 CEST53376018.8.8.8192.168.2.15

              DNS Queries

              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
              Apr 20, 2025 19:18:28.894866943 CEST192.168.2.158.8.8.80xc2abStandard query (0)update.byeux.comA (IP address)IN (0x0001)false

              DNS Answers

              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
              Apr 20, 2025 19:18:29.052750111 CEST8.8.8.8192.168.2.150xc2abNo error (0)update.byeux.com107.189.28.127A (IP address)IN (0x0001)false

              System Behavior

              General

              Start time (UTC):17:18:28
              Start date (UTC):20/04/2025
              Path:/tmp/logs.elf
              Arguments:/tmp/logs.elf
              File size:80974 bytes
              MD5 hash:b87154c46db7a0cdeb26029d38c1e258

              File Activities

              Process Activities


              General

              Start time (UTC):17:18:28
              Start date (UTC):20/04/2025
              Path:/tmp/logs.elf
              Arguments:-
              File size:80974 bytes
              MD5 hash:b87154c46db7a0cdeb26029d38c1e258

              Process Activities


              General

              Start time (UTC):17:18:28
              Start date (UTC):20/04/2025
              Path:/tmp/logs.elf
              Arguments:-
              File size:80974 bytes
              MD5 hash:b87154c46db7a0cdeb26029d38c1e258

              File Activities

              Process Activities


              General

              Start time (UTC):17:18:28
              Start date (UTC):20/04/2025
              Path:/tmp/logs.elf
              Arguments:-
              File size:80974 bytes
              MD5 hash:b87154c46db7a0cdeb26029d38c1e258

              Process Activities


              General

              Start time (UTC):17:18:28
              Start date (UTC):20/04/2025
              Path:/tmp/logs.elf
              Arguments:-
              File size:80974 bytes
              MD5 hash:b87154c46db7a0cdeb26029d38c1e258

              Process Activities